The root of most security problems is software that fails in unexpected ways. Although software security as a field has much maturing to do, it has much to offer to those practitioners interested in striking at the heart of security problems.

This chapter is from the book

". . . any program, no matter how innocuous it seems, can
harbor security holes We thus have a firm belief that everything is guilty until
proven innocent."WILLIAM CHESWICK AND STEVE BELLOVIN:
FIREWALLS AND INTERNET SECURITY

Computer security is an important
topic. As e-commerce blossoms, and the Internet works its way into every nook
and cranny of our lives, security and privacy come to play an essential role.
Computer security is moving beyond the realm of the technical elite, and is
beginning to have a real impact on our everyday lives.

It is no big surprise, then, that security seems to be popping up
everywhere, from headline news to TV talk shows. Because the general public
doesn't know very much about security, a majority of the words devoted to
computer security cover basic technology issues such as what firewalls are, what
cryptography is, or which antivirus product is best. Much of the rest of
computer security coverage centers around the "hot topic of the day,"
usually involving an out-of-control virus or a malicious attack. Historically,
the popular press pays much attention to viruses and denial-of-service attacks:
Many people remember hearing about the Anna Kournikova worm, the "Love
Bug," or the Melissa virus ad nauseam. These topics are important, to be
sure. Nonetheless, the media generally manages not to get to the heart of the
matter when reporting these subjects. Behind every computer security problem and
malicious attack lies a common enemybad software.

It's All about the Software

The Internet continues to change the role that software plays in the business
world, fundamentally and radically. Software no longer simply supports back
offices and home entertainment. Instead, software has become the lifeblood of
our businesses and has become deeply entwined in our lives. The invisible hand
of Internet software enables e-business, automates supply chains, and provides
instant, worldwide access to information. At the same time, Internet software is
moving into our cars, our televisions, our home security systems, and even our
toasters.

The biggest problem in computer security today is that many security
practitioners don't know what the problem is. Simply put, it's the
software! You may have the world's best firewall, but if you let people
access an application through the firewall and the code is remotely exploitable,
then the firewall will not do you any good (not to mention the fact that the
fire-wall is often a piece of fallible software itself). The same can be said of
cryptography. In fact, 85% of CERT security advisories
1 could not
have been prevented with cryptography [Schneider, 1998].

Data lines protected by strong cryptography make poor targets.
Attackers like to go after the programs at either end of a secure communications
link because the end points are typically easier to compromise. As security
professor Gene Spafford puts it, "Using encryption on the Internet is the
equivalent of arranging an armored car to deliver credit card information from
someone living in a cardboard box to someone living on a park bench."
Internet-enabled applications, including those developed internally by a
business, present the largest category of security risk today. Real attackers
compromise software. Of course, software does not need to be Internet enabled to
be at risk. The Internet is just the most obvious avenue of attack in most
systems.

This book is about protecting yourself by building secure software.
We approach the software security problem as a risk management problem. The
fundamental technique is to begin early, know your threats, design for security,
and subject your design to thorough objective risk analyses and testing. We
provide tips and techniques that architects, developers, and managers can use to
produce Internet-based code that is as secure as necessary.

A good risk management approach acknowledges that security is often
just a single concern among many, including time-to-market, cost, flexibility,
reusability, and ease of use. Organizations must set priorities, and identify
the relative costs involved in pursuing each. Sometimes security is not a high
priority.

Some people disagree with a risk management security approach. Many
people would like to think of security as a yes-or-no, black-or-white affair,
but it's not. You can never prove that any moderately complex system is
secure. Often, it's not even worth making a system as secure as possible,
because the risk is low and the cost is high. It's much more realistic to
think of software security as risk management than as a binary switch that costs
a lot to turn on.

Software is at the root of all common computer security problems. If
your software misbehaves, a number of diverse sorts of problems can crop up:
reliability, availability, safety, and security. The extra twist in the security
situation is that a bad guy is actively trying to make your software misbehave.
This certainly makes security a tricky proposition.

Malicious hackers don't create security holes; they simply
exploit them. Security holes and vulnerabilitiesthe real root cause of the
problemare the result of bad software design and implementation. Bad guys
build exploits (often widely distributed as scripts) that exploit the holes. (By
the way, we try to refer to bad guys who exploit security holes as malicious
hackers instead of simply hackers throughout this book. See the
sidebar for more details.)